GlobalProtect macOS Privilege Escalation: Patch Available for Root Access Flaw

Palo Alto Networks has released a patch for a local privilege escalation vulnerability in its GlobalProtect application for macOS. The flaw, tracked as CVE-2026-0315, allows a local user without administrative rights to escalate their privileges to root. This means an attacker with physical or remote access to a user account could potentially execute arbitrary commands with full system control. The vendor rates the severity as medium, with a suggested urgency of moderate.

In plain English

The GlobalProtect app is a common endpoint security tool used to connect devices to corporate networks. On macOS, a specific flaw in how the application handles permissions allows a standard user to break out of their restricted environment. Once inside, they can run commands as the system administrator, or root. This does not require any special configuration or additional software to be present on the Mac. The vulnerability is contained entirely within the macOS version of the application.

The background

According to the Palo Alto Networks PSIRT advisory, the vulnerability affects GlobalProtect App version 6.3 on macOS, as well as versions from 6.2.0 up to 6.3.3. Specifically, builds prior to 6.2.8-h15 and 6.3.3-h16 are vulnerable. The vendor states that the GlobalProtect apps for Linux, Windows, iOS, Android, and Chrome OS are not affected by this issue. Palo Alto Networks reports it is not aware of any malicious exploitation of this vulnerability in the wild.

What changes now

Security teams must update affected macOS endpoints to GlobalProtect App version 6.3.3-h16 (build 6.3.3-1199) or later. This update resolves the privilege escalation path. Organizations should verify which versions are currently deployed across their macOS fleet. Since no special configuration triggers the bug, any installed instance within the vulnerable range is at risk. The fix is a standard software update provided by the vendor.

Who needs to act first

Teams should prioritize updating macOS systems that are exposed to untrusted networks or used by high-privilege employees. Isolate critical endpoints if immediate patching is not possible. Verify the current version before deploying updates to avoid unnecessary restarts. Test the new build in a small group to ensure compatibility with existing network policies. Monitor logs for unusual privilege changes during the rollout phase.

Background: Privilege escalation attacks

Monitor for unexpected process spawning from low-privilege contexts, changes to system binaries, and abnormal access to sensitive configuration files. Correlate these signals with user behavior baselines to catch lateral movement before it becomes a full compromise.

Read the full guide: Detect Privilege Escalation Attacks: Log Signals and Blind Spots

What to do and how to stay safe: Palo Alto Networks

• Audit your macOS fleet to identify devices running GlobalProtect versions older than 6.3.3-h16.
• Restrict local administrative access on macOS endpoints to reduce the impact of potential escalation.
• Monitor system logs for unexpected privilege changes or command executions from standard user accounts.
• Deploy the vendor-provided update once testing confirms stability in your specific environment.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which operating systems are affected by CVE-2026-0315?

Only macOS is affected. The GlobalProtect apps for Linux, Windows, iOS, Android, and Chrome OS are not vulnerable.

Is there a fix available for this vulnerability?

Yes, users should upgrade to GlobalProtect App version 6.3.3-h16 (build 6.3.3-1199) or later on macOS.

Has this vulnerability been exploited in the wild?

Palo Alto Networks states it is not aware of any malicious exploitation of this issue.